For (a), use a secure browser that support URL whitelist and/or kiosk mode 

For (b), use whitelists in application-run-control profile policy

For (c), should be automatic, but possibly with model/mode dependent time delays as stipulated by platform owner or device OEM vendor support pages